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hen any of us complete a survey, 

rent a video or subscribe to a 
magazine, we give out information about 
ourselves. With each transaction, we leave 
a “data trail” of our personal histories and 
preferences. Companies use and store this 
information electronically, often without 
our knowledge or consent. Consumer pro- 
files and personal information are bought 
and sold in the marketplace within Canada 
and internationally. Recent examples in the 
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media of privacy problems include a U.S. 
judge whose video rental habits were made 
public, and a customer loyalty program 
whose members found their personal 
information left unsecured on the 
program’s Web site. 


In this information age, people use the terms 
privacy, security of personal information and 
data protection interchangeably. Personal 
information or data can be any information 
about an identifiable individual that is 


Is My Privacy More at Risk Than Before? 


A majority of Canadians say they have less 
privacy in their lives than they did 10 years 
ago. This is largely due to the deyelopment 
of technology that has changed the way 

we do everyday things. Data can now be 
collected and stored on virtually every 
transaction that we make in the market- 
place. Electronic cards are more and more 
common, making it possible for our move- 
ments to be tracked. Our wallets are bulging 
with magnetic-striped cards of all kinds, 
for financial transactions or to accumulate 
air miles or customer loyalty points. 


In everyday transactions, businesspeople 
ask us for our telephone number, social 
insurance number, address and driver’s 
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licence number and we provide them — 
often without knowing or asking what will 
be done with this personal data. Through 
advances in computers and telecommuni- 
cations, personal information can now be 
quickly and inexpensively collected, 
processed and transmitted. 


As consumers and citizens we need to know 
that we have some control over our personal 
information, and we want to be assured 
that it enjoys a basic level of protection. 
We need to be confident that the com- 
panies we do business with are following 
some basic privacy protection rules. 
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e ls My Privacy More at Risk Than Before? 
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e What is Privacy Invasion? 
¢ Canada to Enshrine Privacy Right into Federal Law 


¢ Consumer-focussed Legislation 


ping Private Lives Private 


recorded in any form, be it electronically 

Or on paper. Some examples include a 
person’s age, income, religion, financial 
transactions, medical history or occupation. © 


~ For some people, private information is 


a commodity to buy and sell. Businesses 
target their marketing efforts at certain 
customers, so private information is valu- 
able to them. Many consumers, though, 
are unaware of how valuable private data 
is or how it can be used. 


What Canadians Think 
of Privacy Protection 
Eighty percent of Canadians think personal 
data should be kept strictly confidential. 
Sixty-five percent of Canadians think it is “not 
at all acceptable” for companies to sell, trade 
or share detailed lists of personal information 
with other organizations. 
Nine in ten Canadians strongly disapprove of 
companies trafficking in information about 
their private lives without their consent. 


Ninety-four percent of Canadians feel it is 
important to have safeguards to protect 
personal information on the Internet. 


Source: Angus Reid Survey, July 1998 
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What is Privacy Invasion? 


Privacy invasion occurs when individuals or organizations use our personal information 
without us being aware of it and without us agreeing to its use. Our personal information 
is our own — anyone collecting it should be required to ask for our consent. 


Here are just a few examples of the types of personal information available to people and 
businesses willing to look for it or pay for it: 

e information about the mortgage on our house 

e the sites we visit on the Internet 

© alist of the purchases we make on our credit cards. 


Canada to Enshrine 


Privacy Right into Federal Law 


Currently, the federal government and 
most provinces have legislation governing 
the collection, use and disclosure of per- 
sonal information held by governments, 
but not by the private sector. To date, 
Quebec is the only province that has 
adopted comprehensive privacy legislation 
that applies to the information held by the 
private sector. 


Bill C-54, the Personal Information 
Protection and Electronic Documents Act, 
which was introduced in Parliament on 
October 1, 1998, will change all that. 


If passed, the law would apply to com- 
mercial activities that involve personal 
information, and would make the entities 
engaging in those activities accountable 
for how they collect, use and disclose 
personal information. 


The law would apply first to the federally 
regulated sectors of banking, tele- 
communications and interprovincial 
transportation (e.g. airlines). Three 
years later, the law would apply to all 
commercial activities across the country 
except those in provinces and territories 
that have adopted similar privacy protec- 
tion legislation. This phased-in approach 
would allow provinces to enact their own 
laws. If they do not, the federal law would 
apply to all commercial transactions, 
ensuring privacy protection for all 
Canadians. Non-commercial personal 
information concerning health and 
education is an area of provincial 
jurisdiction that the federal law 

does not address. 


The new law would also give individuals 
the right to determine when, how and to 
what extent they would share information 
about themselves. Individuals would also 
have the right to have access to personal 
information about themselves and to 
complain to the Privacy Commissioner of 
Canada when they believe a commercial 
organization was not complying with the law. 


[f passed, the law would apply to com- 
mercial activities that involve personal 
information, and would make the 
entities engaging in those activities 
accountable for how they collect, use 
and disclose personal information. 


The new legislation is based on the 
Canadian Standards Association’s (CSA) 
Model Code for the Protection of Personal 
Information, which was developed by 
businesses, consumers and governments, 
and became a national standard in 1996. 
The CSA is an independent, not-for-profit 
organization that operates nationally and 
internationally. It is a leader in the field of 
standards development and the application 
of these standards through production 
certification, quality and environmental 
management systems registration, and 
information products. 


Canada was the first country in the world 
to establish a voluntary, national standard 
for the protection of personal information. 
Federal, provincial and territorial ministers 
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responsible for the Information Highway 
agreed to support the CSA model code as 
a minimum standard for privacy protection 
in all jurisdictions. 


The federal government recognizes the 
value of the voluntary privacy standard and 
the efforts of the businesses and organiza- 
tions that adhere to it, but believes that 
legislative measures must be taken to 
ensure that all Canadians enjoy privacy 
protection. 


The new legislation is based on the 
Canadian Standards Association's 
Model Code for the Protection of 
Personal Information, which was 
developed by businesses, consumers 
and governments, and became a 
national standard in 1996. 


rivacy protection is good business for 
oth consumers and companies. 


‘onsumers should try to do business 

vith companies that are committed to 
especting the basic principles of privacy 
rotection set out below. Companies 
hould be aware that privacy protection 

3 important to their clients. 


. Accountability 

An organization is responsible for per- 

sonal information under its control 
_and shall designate an individual or 

individuals who are accountable for 

__ the organization’s compliance with 

{ the following principles. 


. Identifying Purposes 

_ The purposes for which personal 

a information is collected shall be iden- 
tified by the organization at or before 
_ the time the information is collected. 


. Consent 

. The knowledge and consent of the in- 
dividual are required for the collection, 

use or disclosure of personal infor- 
mation, except when inappropriate. 


4. Limiting Collection 
The collection of personal information 
shall be limited to that which is neces- 
sary for the purposes identified by the 
organization. Information shall be 
collected by fair and lawful means. 


). Limiting Use, 

Disclosure and Retention 
Personal information shall not be used 
or disclosed for purposes other than 
those for which it was collected, except 
with the consent of the individual or as 
required by the law. Personal infor- _ 
‘mation shall be retained only as long 
as necessary for the fulfilment a 

those purposes. 


6. Accuracy : 

Personal information shall ben 
accurate, complete and up-to-date as 
is necessary for the purposes for 
which it is to be used. 

7. Safeguards 
Personal information shall be _ 
protected by security safeguards 
appropriate to the sensitivity of | 
the information. 


8. Openness 
An organization shall make readily 
available to individuals specific 
information about its policies and 
practices relating to the management — 
of personal information. 


9. Individual Access 

Upon request, an individual shall be 
informed of the existence, use and 
disclosure of his or her personal 
information and shall be given access 
to that information. An individual shall — 
be able to challenge the accuracy and 
completeness of the information and 
have it amended as appropriate. 


10. Challenging Compliance 


An individual shall be able to address a 
challenge concerning compliance with 
_ the above principles to the designated 
individual or individuals accountable 
for the organization’s compliance. 


Source: Your Guide to CSA's Privacy Code. 


CSA Consumer Services. March 1997. 


Quebec Privacy 
Protection 


In 1994, Quebec passed an act respecting the 
protection of personal information in the pri- 
vate sector (Loi sur la protection des renseigne- 
ments personnels dans le secteur privé). The Act 
grants individuals a right of access to personal 
information held by businesses operating in 
Quebec. It also regulates the collection, use 
and disclosure of personal information. The 
provincial access to information commission (la 
Commission d’accés a |’'information) oversees 
the legislation and is responsible for conduct- 
ing investigations and settling disputes. 


Consumer-focussed Legislation 


The Privacy Commissioner of Canada is already responsible for 
overseeing access to information and privacy laws as they apply to the 
federal government. Under Bill C-54, this mandate would be extended. 
5 The Commissioner would oversee the application of the privacy 
legislation as it applies to transactions in the private sector, receive and 

| investigate complaints from consumers, and mediate disputes. 


A mandate for public education/information has also been given to the 
Commissioner as part of Bill C-54. In his submission to the Standing 
Committee of the House of Commons reviewing the proposed 
legislation, Privacy Commissioner Bruce Phillips said, “The research and 
education role is critically important. If individuals do not understand 
the many ways in which their informational privacy is threatened, public 
appreciation of and support for the privacy-enhancing measures of the 
bill will not crystallize. In the end, individual privacy will be the loser.” 


The Quebec Charter of Human Rights and 
Freedoms, which came into force in 1975, 
enshrines a general right to privacy for 
residents. The right was also enshrined in 
Quebec’s Civil Code in 1991. Quebec is the 
only province with such an extensive range 
of privacy protections. 
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International Privacy Rules 


Globalization, particularly the growth in 
international trade in services, and in 


the expansion of multinational companies, 


means that personal information often 
crosses national borders. For example, a 
company in one country may use a service 
provided in another country to store and 
maintain its customer databases. 
Unfortunately, some countries offer 

no safeguards to protect this type of 
information. 


[In 1995, the European Union passed 
its Data Protection Directive to 
protect personal information and 
harmonize privacy laws among 
its 15 member states. 


For Further 
Information 


™ about privacy, contact Kernaghan Webb, 
Senior Policy Analyst 
E-mail: webb.kernaghan@ic.gc.ca 
Tel.: (613) 952-2534 


= about Consumer Quarterly, 
contact Cathy Enright, 
Office of Consumer Affairs 
E-mail: enright.cathy@ic.gc.ca 
Tel.: (613) 952-3466 


Or write to: 


Office of Consumer Affairs 
Industry Canada 

9th Floor, East Tower 

235 Queen Street 

Ottawa ON K1A 0H5 


Fax: (613) 952-6927 


Consumer Quarterly is also available 

on Consumer Connection, the Office of 
Consumer Affairs’ home page on Strategis, 
Industry Canada’s business information 
Web site: 

English 
http://strategis.ic.gc.ca/oca 
French 
http://strategis.ic.gc.ca/be 
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In 1980, the Organisation for Economic 
Co-operation and Development addressed 


this challenge by developing Guidelines on 


the Protection of Privacy and Transborder 
Flow of Personal Data. Canada’s Bill C-54 
follows these internationally accepted 
guidelines, and Quebec’s privacy legisla- 
tion also meets them. 


In 1995, the European Union passed its 
Data Protection Directive to protect 
personal information and harmonize 
privacy laws among its 15 member states. 


The Best Protection i is ‘a be Alert 


Be aware that some individuals or businesses may po use or trade information 
about you without your knowledge or consent. 3 


Be aware of the kind of information, and how much, you are disclosing apoilt 
yourself. Surveys and warranty registration cards that require you to provide 
personal information are often used by Sipe seesy to create consumer Don : 


which they may sell to other companies. 


Before you submit personal information, always find out howd it will be used. 


Do not give out personal information unless you receive a satisfactory explanation 
of why it is required and how it will be used. 


Do not automatically give out your social insurance number. There are very few. 


The directive, which came into force on 
October 25, 1998, can prevent data flow 
to countries in which adequate privacy 
protection is not ensured. Bill C-54 is 
intended to set a standard for the protec- 
tion of personal information that protects 
Canadians when their information moves 
beyond Canada’s borders. Consequently, 
it would allow Canadian business wider 
access to markets abroad with strong 
privacy protection for their citizens. 


legitimate occasions when you are required to provide it. Social insurance numbers = 
are only required in very specific circumstances relating to federal government — 


activities such as income tax collection and income secunty programs. 


When surfing, E-mailing or shopping on the Internet, assume your communication : 


is public, unless you use encryption software. 


To Find Out More... 


Privacy Commissioner of Canada 


1-800-267-0441 
http://www. privcom.gc.ca 


Toll-free: 
Web site: 


Electronic Commerce Task Force 


Web site: 


http://e-com.ic.gc.ca/english/privacy/632d1.htm 


This Web site links to sites of the provincial privacy commissioners 


(click on Provincial & Territorial Activities). 
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